Why does an encryption key derived from your lock screen password give you "stronger protection" than a key chosen by the machine (or at any rate not derived from your lock screen password)?
The context in which the above generic question arises for me is a Samsung mobile phone running on Android 11. So a more specific question (if that is preferable) would be: Why the above is the case for that particular device.
In what follows, I will describe the context in more detail. If the question as stated above is already answerable, you may not have to read any further.
As far as I can make out, this is what happens with an Android 11 Samsung phone.
Encryption, in the sense of the machine's jumbling the data in storage, is always on (with no option to turn it off), but it may or may not give you any protection depending on which of the three cases below applies.
Case 1. There is no lock screen password (where 'password' is a term of convenience that includes PIN, pattern etc. as well): You get no protection. The data may be encrypted, but anyone can get them decrypted without having to enter a password.
Case 2. A lock screen password is set, but the "Strong protection" is off: You get protection. The machine chooses the encryption key.
Case 3. A lock screen password is set and the "Strong protection" is on: You get more protection. The encryption key is derived from your lock screen password.
Note. On the device, "Strong protection" is in Settings > Biometrics and security > Other security settings > "Strong protection." The blurb for it says, "Encrypt your phone using your secure lock type (pattern, PIN, or password)."
If my understanding so far is wrong, please tell me so. The question may not even arise then, and I may have to delete it.
Assuming then that the understanding is correct, the question is why derivation of the encryption key from something you chose gives you stronger protection? I would have thought the machine could do without your help (which may be 1234) to choose a strong encryption key.
By the way, are there technical terms for encryption (in the sense of data jumbling whether or not it gives you any protection) vs. protection?
Case 3, as stated above, is wrong because of the way the term 'password' was defined (to include biometrics through 'etc.').
To get the benefit of an encryption key that is itself encrypted (with something you chose), you need to use the following:
- Case 3b. A lock screen pattern, PIN, or alphanumeric password is set and the "Strong protection" is on.
For why this is so, see A. Hersean's answer.
(I did not want anyone, having read only the question, to go away with the wrong information. I choose this manner of correcting the post, rather than striking out 'etc.', because the exclusion of biometrics is made more prominent and I don't want to appear to have got the thing right at the outset.)